2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

General

Target
2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 262KB
Sample261024-x5w4vsff45
SHA256 46c852e25f2e3b9becc84169169f5b35265699b91d5d2b30f91fbd45d49d20ce
MD5 20dde7a853776ac72a4b562a41d905ab
SHA1 9008843ba2d10eb53b6c032f4f61c2c869349ac4
SHA512 9031ed1fe601af55eda308d5747dc0e8788a6893a928e9ccd78ea326bcc2200c28dd88dbd50c26855d45cd7cd29664ae5cd533127d2fbc9be194936471e73fb1
SSDEEP 3072:r97D7oFrq+CDk4nSDd2UC9dO20C0Fb0Re8L/wweKmVzF9KKbuAs0FNmhMn+IhN66:tDvnSDdLSc2pa0ReTN9KvYlk03QsWCD
TLSH
T14E446A05B5CA8072D475643107778BF21B2DAE305A92D98FA7C53B2ADA3C1C1F91AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

File Explorer

2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

.exe 262KB

2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

IMPHASH f7365c635306e324116f7095b34719e1
SHA256 46c852e25f2e3b9becc84169169f5b35265699b91d5d2b30f91fbd45d49d20ce
MD5 20dde7a853776ac72a4b562a41d905ab
SHA1 9008843ba2d10eb53b6c032f4f61c2c869349ac4
SHA512 9031ed1fe601af55eda308d5747dc0e8788a6893a928e9ccd78ea326bcc2200c28dd88dbd50c26855d45cd7cd29664ae5cd533127d2fbc9be194936471e73fb1
SSDEEP 3072:r97D7oFrq+CDk4nSDd2UC9dO20C0Fb0Re8L/wweKmVzF9KKbuAs0FNmhMn+IhN66:tDvnSDdLSc2pa0ReTN9KvYlk03QsWCD
TLSH
T14E446A05B5CA8072D475643107778BF21B2DAE305A92D98FA7C53B2ADA3C1C1F91AB37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

107018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\b\bin\win32\venvlauncher.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

WriteConsoleW SetEndOfFile InitializeCriticalSectionAndSpinCount HeapReAlloc GetStartupInfoW SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject CompareStringW GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFileAttributesW DuplicateHandle MultiByteToWideChar FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateJobObjectA CreateProcessW GetExitCodeProcess HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW WriteFile GetCommandLineA HeapFree HeapAlloc GetFileType LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap GetFileSizeEx SetFilePointerEx CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_20dde7a853776ac72a4b562a41d905ab_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat

version

kernel32

generic